Messages

Disabled ISC, reboot, flag gone, all good, apparently! :-D

Thanks for your time and knowledge...

Will enable again when the feature will be exposed in the GUI.

Again, many thanks for clarifications!

I and apparently some others used it as a feature to limit access in some subnets. So: Not useless. Nothing is perfect. But it worked.

And there is at least one other BSD-based firewall solution offering "static ARP" option in the GUI for KEA Dhcp. Just saying.


The first thread I linked stated that disabling static ARP in ISC was NOT enough to remove the flag on interface level.

Is there an option in the GUI to see the equivalent of ifconfig <iface> to check the flags? Or only in the console? :-)

So basically we have here a critical parameter which can be set from the GUI, but not be reversed?

What ist the fall-back, if I can't reach the opnsense anymore after switiching to Kea?

What commands do I have enter in the console to make static ARP go away on the infterface level?

Ok, thanks. So what is correct way to avoid loosing access to interfaces while moving from ISC to KEA, when static ARP was enabled in ISC?

If I read the above thread correct it is not sufficient to disable static ARP in ISC to "reset" the interface ot non-static ARP.

Have to spent time selecting an option, DNSmasq, or Kea, then ....

Would be interesting to know, if this new feature in the pull request is in the current version and if yes: Where to find it? Individual interface?

Hello again,

currently I'm underway moving my static leases from ISC to KEA (**sigh**, so much lifetime lost on absolutely unproductive work...) and found this here:

https://forum.opnsense.org/index.php?topic=48854.0

I have static ARP enabled on many interfaces, so that only reserved MAC-IPs can talk to the sense. What will happen with these static ARP configurations when I disable ISC and enable KEA in the future? Will the "static ARP" on the interface persist?

Guess this still is a show-stopper for KEA, as it doesn't have this feature, or?

PS: Also found and read this here:

https://forum.opnsense.org/index.php?topic=49029.0

But the "discussion" ended nowhere in this thread, too.

Any help highly appreciated!

Moin,

und das ganze Gerödel muss man von HAND übertragen? Jede einzelne reservierte IP für MAC?

Mir ist eigentlich nicht langweilig...

I'm on 26.7.3 and need to disable a FW rule, but I don'T see any option to do so unter "FW rules". Just need this rule disabled, no time for playing arround with stuff this morning. Help!

Rookie! :-p

But thanks a lot, too. :-)  Although I never got involved. To many other things arround and not really much I could help anyways.

...see here:

https://docs.opnsense.org/security.html

WARNING BOX

At least not this gem:

https://lists.freebsd.org/archives/freebsd-announce/2026-July/000301.html

https://www.veeder.com/us/

srsly? You want to have this on your LAN? Together with office Windows PC and some DVR and expose all of them to the interwebs?

Why use a "firewall" in the first place? Get a switch and done. Don't expect it will take longer than a few minutes and all your network is compromised.

Have you tried spoofing the Cisco WAN MAC to your sense WAN?

Hi!

Old topic, I know, but comes up with interwebs search for opnsense firewall migration, so:

Haven't moved to new firewall rules, due to lack of time to wrap my head around the process. So at this point, what is the recommendation:

Migrate on 26.1.latest or wait till 26.7 arrives and migrate in fall?

Thanks in advance!

...I see stuff with WG tunnels (non-connecting, stopping randomly, not starting services on reboot) which shows no pattern or is not related to any changes at the endpoints. There is something weird going on.

Sometimes a restart of the service resolves it, sometimes a reboot is needed. On an ancient pfsense I have to re-install (!) the WG plugin (via another, working WG tunnel to another opnsense, really scary if you are remote...) to make a specific tunnel to an opnsense come up again from time to time.